3 Exchange 2010sp1, CA, Hub, Mail (DAG), Windows 2008R2 TMG 2010sp1 with Edge server role Remote Connectivity Analyzer for Autodiscover and Outlook Anywhere says "Connectivity Test Successful" but when trying to setup a profile in Outlook 2007 & 2010 (entering name, email address, and password) I get an error "An encrypted connection to your mail server is not available." Does anyone have ideas what's going wrong and how to troubleshoot this further? Thanks in advance for any help.

Just noticed there was an "Test Email AutoConfiguration" tool in Outlook 2010. I'll see if I can decipher the log results to help further troubleshoot this problem.

1. Outlook Anywhere 2. I can setup a profile manually on a computer. 3. I don't see anything in the event log. When I run the "Test E-mail AutoConfiguration" in Outlook 2010 I see: When testing external email address: Autodiscover to https://autodiscover.external.name/autodiscover/autodiscover.xml starting Autodiscover request completed with http status code 500 Autodiscover to https://autodiscover.external.name/autodiscover/autodiscover.xml Failed (0x8004005) When testing internal email address: Autodiscover to https://autodiscover.internal.name/autodiscover/autodiscover.xml starting Autodiscover internet timeout against URL https://autodiscover.internal.name/autodiscover/autodiscover.xml Autodiscover internet timeout against URL https://autodiscover.internal.name/autodiscover/autodiscover.xml Autodiscover to https://autodiscover.internal.name/autodiscover/autodiscover.xml Failed (0x800C8203)

In a web browser using the public domain name, I get a FBA login page from our TMG. After I login with username and password I get an errorcode 600 response ( which I believe is the expected response). From a browser using autodiscover.internal.domain/autodiscover/autodiscover.xml I get a 403 "forbidden" error. If I use https://servername.internal.domain/autodiscover/autodiscover.xml I get prompted with a "windows security" login box for username and password, I enter my credentials and get the same error code 600 response. Checked web.config permissions and they looked okay. Here's the output from the test-OutlookWebServices command: RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1019 Type : Information Message : A valid Autodiscover service connection point was found. The Autodiscover URL on this object is https://EX CHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1006 Type : Information Message : Contacted the Autodiscover service at https://EXCHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1016 Type : Information Message : [EXCH] The AS is configured for this user in the Autodiscover response received from https://EXCHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1015 Type : Information Message : [EXCH] The OAB is configured for this user in the Autodiscover response received from https://EXCHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1014 Type : Information Message : [EXCH] The UM is configured for this user in the Autodiscover response received from https://EXCHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1016 Type : Warning Message : [EXPR] The AS is not configured for this user in the AutoDiscover response received from https://EXCHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1015 Type : Warning Message : [EXPR] The OAB is not configured for this user in the AutoDiscover response received from https://EXCHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1014 Type : Warning Message : [EXPR] The UM is not configured for this user in the AutoDiscover response received from https://EXCHX1.internal.domain/Autodiscover/Autodiscover.xml. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1022 Type : Success Message : Autodiscover was tested successfully. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1021 Type : Information Message : The following web services generated errors: As,Oab,UM in EXPR. Use the previous output to diagnose and correct the errors. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1024 Type : Success Message : [EXCH] Successfully contacted the AS service at https://exchx1.internal.domain/EWS/Exchange.asmx. The elapsed time was 46 milliseconds. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1026 Type : Success Message : [EXCH] Successfully contacted the UM service at https://exchx1.internal.domain/EWS/Exchange.asmx. The elapsed time was 0 milliseconds. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1124 Type : Success Message : [Server] Successfully contacted the AS service at https://exchx1.internal.domain/ews/exchange.asmx. The elapsed time was 546 milliseconds. RunspaceId : 56d1849c-baff-4b08-a801-3b5614dfee29 Id : 1126 Type : Success Message : [Server] Successfully contacted the UM service at https://exchx1.internal.domain/ews/exchange.asmx. The elapsed ti me was 0 milliseconds.

I opened a support incident with Microsoft for this issue. Their TMG team had me create an Exchange Publishing rule specifically for Autodiscover. Previously I had created separate publishing rules for OWA, OA, ActiveSync but not one for AutoDiscover itself. The new rule used the same web listener as my other rules. For AUTHENTICATION DELEGATION, it was set to "No delegation, but client may authenticate directly". For USERS, it was set to "All Users" NOT "All authenticated Users".